Which of the following is one way to implement countermeasures on an IoT gateway to ensure physical security?

Limiting physical access to ports is a fundamental and critical countermeasure for securing an IoT gateway. Unprotected ports, such as USB, JTAG, or serial console ports, represent a significant physical attack surface. An attacker with physical access could use these ports to dump firmware, access a command-line interface, bypass security controls, or introduce malicious code. By disabling unused ports in the software/firmware or physically blocking them (e.g., with epoxy or locking covers), an organization can effectively prevent these common physical attack vectors, thereby hardening the device against unauthorized access and tampering.

A. Add tamper detection to the enclosure: While a valid physical security measure, it is primarily a detective control that alerts on a breach, whereas limiting port access is a preventative control that stops the breach from occurring.
C. Allow quick administrator access for mitigation: This is an incident response procedure, not a direct physical security countermeasure implemented on the gateway to prevent or detect an attack.
D. Implement features in software instead of hardware: This is contrary to security best practices. Hardware-based security is generally more robust and resistant to tampering than software-only implementations.

1. NISTIR 8259A

"IoT Device Cybersecurity Capability Core Baseline" (May 2020): In Section 3.2

"Device Security

" the document specifies the core baseline capability 3.2.5 Physical Interfaces: "The IoT device should restrict the logical access that authenticated and unauthenticated users and processes have to its physical interfaces (e.g.

USB

JTAG

UART)." This directly supports the practice of limiting port access as a key security measure.

2. ENISA (European Union Agency for Cybersecurity)

"Good Practices for IoT and Smart Infrastructures Security" (November 2018): In Section 4.2.1

"Physical Security

" under the "Device Layer" recommendations

the guide states: "Unused ports should be disabled and protected (e.g. USB ports)." This highlights port protection as a standard good practice for IoT device hardening.

3. OWASP

"IoT Security Verification Standard (ISVS)" (Version 2.1.0

2023): In section V8

"Hardware Security

" requirement ISVS-HS-2 states: "Verify that all external ports and debugging interfaces that are not needed for the device's operation are disabled." This emphasizes disabling ports as a verifiable security requirement for IoT hardware.